Cryptojacking Campaign Employs Deleted GitHub Account and Unofficial GitHub CDN

guest · Aug 1, 2018

Cryptojacking Campaign Employs Deleted GitHub Account and Unofficial GitHub CDN
August 1, 2018
https://www.bleepingcomputer.com/news/security/cryptojacking-campaign-employs-deleted-github-
account-and-unofficial-github-cdn/

Cybercriminals appear to have an obsession with abusing GitHub and GitHub-related services to hide in-browser cryptocurrency mining scripts that they later use on hacked sites.
Cryptojackers abuse RawGit CDN
Now, researchers from cyber-security firm Sucuri say they've found another, more clever way, in which crooks abused not GitHub, but an unofficial GitHub-related service.

This service is RawGit, a CDN service that caches GitHub files indefinitely, even after the original file has been deleted from GitHub or the GitHub user has deleted his account.

The technique is arguably very clever, as it abuses a service known only to web developers, who often used RawGit URLs in the past for their HTML previewing functionality (as Bleeping Computer does with its Patch Tuesday reports).
RawGit's fast abuse department foils attackers' scheme
But while the three previous cryptojacking campaigns that leveraged GitHub domains were somewhat successful, this one appears to be a colossal failure, and for two very different reasons [...]
Click to expand...

Log in or Sign up

Cryptojacking Campaign Employs Deleted GitHub Account and Unofficial GitHub CDN

guest Guest

Log in or Sign up

Cryptojacking Campaign Employs Deleted GitHub Account and Unofficial GitHub CDN

guest Guest

Useful Searches